COMMAND
	    sh3 (kernel)
SYSTEMS AFFECTED
	    NetBSD
PROBLEM
	    Following  is  based  on  a  NetBSD  Security  Advisory  2001-008.
	    Missing validation  of user-supplied  arguments to  a system  call
	    can allow user  applications on the  sh3 platform to  execute code
	    with supervisor privileges,  bypassing normal system  protections.
	    This problem is only present  on the sh3 platform, which  includes
	    the dreamcast, evbsh3, hpcsh and mmeye ports.
	    The Hitachi Super-H architecture  includes the Status Register,  a
	    processor register which provides  status information such as  the
	    true/false condition bit, and which also controls properties among
	    which is the processor mode (either user mode or privileged mode).
	    The only component of NetBSD  executing in privileged mode is  the
	    kernel; user processes are restricted to user mode and thus cannot
	    execute  privileged  processor  instructions  or  access   related
	    resources.
	    As a  part of  the protection  model, the  contents of  the Status
	    Register can be modified only when executing in privileged mode.
	    While reviewing code in NetBSD, it was discovered that the  NetBSD
	    "sigreturn" system  call did  not do  validation of  user-supplied
	    Status  Register  contents;  it  was  also  discovered  that   the
	    "process_write_regs" kernel routine, which  is used by the  procfs
	    and ptrace(2)  facilities, did  not do  appropriate validation  of
	    user-supplied Status  Register contents;  in short,  it's possible
	    for a  user process  to construct  and pass  an execution  context
	    which makes it resume in privileged mode.
	    Credits to Klaus Klein for detecting and resolving this problem.
SOLUTION
	    Systems running  NetBSD/evbsh3, NetBSD/dreamcast,  NetBSD/hpcsh or
	    NetBSD/mmeye are vulnerable.  Although the NetBSD Project has  not
	    distributed binary releases for these ports yet, binary  snapshots
	    of development versions are known to be in use.
	    Systems  running  NetBSD-current  dated  from  before May 16, 2001
	    should be upgraded to NetBSD-current dated May 16, 2001 or  later.
	    Systems running NetBSD-release-1-5 dated from before May 27,  2001
	    should be  upgraded to  NetBSD-release-1-5 dated  May 27,  2001 or
	    later.
	    The following patches to
	    - /sys/arch/sh3/include/psl.h,
	    - /sys/arch/sh3/sh3/compat_13_machdep.c and
	    - /sys/arch/sh3/sh3/sh3_machdep.c
	    should be applied before building a new kernel.  This patch can be
	    applied (with offset differences) to NetBSD-1.5 or  NetBSD-current
	    kernel sources using the patch(1) command.
	
	    Index: include/psl.h
	    ===================================================================
	    RCS file: /cvsroot/syssrc/sys/arch/sh3/include/psl.h,v
	    retrieving revision 1.1
	    retrieving revision 1.2
	    diff -u -r1.1 -r1.2
	    --- include/psl.h	1999/09/13 10:31:21	1.1
	    +++ include/psl.h	2001/05/16 12:42:38	1.2
	    @@ -57,8 +57,8 @@
	     #define	PSL_MBO		0x00000000	/* must be one bits */
	     #define	PSL_MBZ		0x8ffffc0c	/* must be zero bits */
	    -#define PSL_USERSET    0
	    -#define PSL_USERSTATIC    (PSL_BL|PSL_RB|PSL_MD|PSL_IMASK)
	    +#define PSL_USERSET	0
	    +#define PSL_USERSTATIC	(PSL_BL|PSL_RB|PSL_MD|PSL_IMASK|PSL_MBO|PSL_MBZ)
	     #ifdef _KERNEL
	     #include <machine/intr.h>
	    Index: sh3/compat_13_machdep.c
	    ===================================================================
	    RCS file: /cvsroot/syssrc/sys/arch/sh3/sh3/compat_13_machdep.c,v
	    retrieving revision 1.2
	    retrieving revision 1.3
	    diff -u -r1.2 -r1.3
	    --- sh3/compat_13_machdep.c	2000/12/22 22:58:55	1.2
	    +++ sh3/compat_13_machdep.c	2001/05/16 12:42:38	1.3
	    @@ -71,16 +71,9 @@
	 	    /* Restore register context. */
	 	    tf = p->p_md.md_regs;
	    -	/*
	    -	 * Check for security violations.  If we're returning to
	    -	 * protected mode, the CPU will validate the segment registers
	    -	 * automatically and generate a trap on violations.  We handle
	    -	 * the trap, rather than doing all of the checking here.
	    -	 */
	    -#ifdef TODO
	    +	/* Check for security violations.  */
	 	    if (((context.sc_ssr ^ tf->tf_ssr) & PSL_USERSTATIC) != 0)
	 		    return (EINVAL);
	    -#endif
	 	    tf->tf_ssr = context.sc_ssr;
	    Index: sh3/sh3_machdep.c
	    ===================================================================
	    RCS file: /cvsroot/syssrc/sys/arch/sh3/sh3/sh3_machdep.c,v
	    retrieving revision 1.12
	    retrieving revision 1.13
	    diff -u -r1.12 -r1.13
	    --- sh3/sh3_machdep.c	2001/04/24 04:31:09	1.12
	    +++ sh3/sh3_machdep.c	2001/05/16 12:42:38	1.13
	    @@ -350,21 +350,13 @@
	 	    /* Restore signal context. */
	 	    tf = p->p_md.md_regs;
	    -	{
	    -		/*
	    -		 * Check for security violations.  If we're returning to
	    -		 * protected mode, the CPU will validate the segment registers
	    -		 * automatically and generate a trap on violations.  We handle
	    -		 * the trap, rather than doing all of the checking here.
	    -		 */
	    -#ifdef TODO
	    -	  if (((context.sc_ssr ^ tf->tf_ssr) & PSL_USERSTATIC) != 0) {
	    -	    return (EINVAL);
	    -	  }
	    -#endif
	    -	  tf->tf_ssr = context.sc_ssr;
	    -	}
	    +	/* Check for security violations. */
	    +	if (((context.sc_ssr ^ tf->tf_ssr) & PSL_USERSTATIC) != 0)
	    +		return (EINVAL);
	    +
	    +	tf->tf_ssr = context.sc_ssr;
	    +
	 	    tf->tf_r0 = context.sc_r0;
	 	    tf->tf_r1 = context.sc_r1;
	 	    tf->tf_r2 = context.sc_r2;